topic Re: stats. eval and search macros? in Splunk Search

stats. eval and search macros?

jgauthier — Mon, 11 Apr 2011 22:06:16 GMT

I am using a search macro in an eval and it returns all zeros. But, when I expand it, it functions as expected. Is that normal?

ie:

 `get_all_email` | stats count(eval(`receive_event`)) as Sent by recipientlist

This returns all zeros.

`get_all_email` | stats count(eval(((event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023)))) as Sent by recipientlist

This works perfectly.

gkanapathy — Mon, 11 Apr 2011 22:50:55 GMT

it would be helpful to see your macro definition/macros.conf file.

jgauthier — Mon, 11 Apr 2011 23:32:53 GMT

Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\

iseval = 0

My other eval/macro was working that looked like this:

[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0

So, I modified the receive_event manually to look like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0

And now it seems to be working.

gkanapathy — Mon, 11 Apr 2011 23:49:03 GMT

that looks like a bug in the UI putting linebreaks into the macro.